Google: Jet Night passed nearly $1 million in stolen model calls

Google’s threat intelligence group and Mandiant say stolen access to enterprise language models is being resold fast enough to move a cloud bill the same day. In the incidents they describe, fraudulent model use has passed $100,000 in a single day. At some organizations the running total reached $1 million before the key was revoked. One reseller, Jet Night, is tied to a single victim’s bill of nearly $1 million.

The researchers describe two clusters feeding one market. One searches for model endpoints left open on the internet. The other takes working keys off machines with weak locks: cloud credentials, service-account keys, GitHub tokens, live session tokens, and model API keys. After that access is sold, volume can jump. Google says the rate can pass 1,000 requests a second. The provider records the calls as ordinary consumption. The company that owned the key receives the invoice.

A $60 plan and a million-dollar victim

Google calls the resellers LLM mixers. They stand in front of hijacked accounts and sell the capacity at a retail price that works only because another company is paying the provider. Jet Night has advertised unlimited use of a frontier model for about $60 a month. Google says one operator, drawing on stolen third-party keys to supply jet-night.com, made more than 500,000 model calls in less than eight hours, and that Jet Night passed nearly $1 million in token cost through to the victim. The same research names a second relay, newapi.pro.

The subscriber pays a flat fee. The victim pays the meter. The mixer keeps the spread, and it sees the prompts.

The shop ran on the victim’s cloud

In some cases the intruders used the compromised cloud to host the relay. Google describes one actor who enabled agents, published reverse proxies, and offered endpoints for several frontier models under the name D1337-KAIROS. The machines on the invoice belonged to the victim. The name on the storefront was the actor’s.

The research also names a flaw in the LiteLLM routing software, CVE-2026-40217. This briefing will not describe that bug. Where LiteLLM sits in front of production models, install the current fix. The router can see every model key it was asked to hold.

A separate cluster, UNC6993, gathers stolen keys and spreads requests across them, with sales that Google assesses as likely moving through underground forums. Once a mixer is attached, the useful clock is hours. The Jet Night case put half a million calls inside a single workday.

What to put on the account today

Put a spend alarm on model APIs that fires the same day, at a figure finance would notice, well under $100,000. A cap that halts calls when the rate or the dollars jump will cut a 1,000-request-per-second resale even after a key has already left. Alert when usage climbs toward hundreds of thousands of calls. Eight hours was enough in the case Google described.

Hold model keys, cloud service-account keys, and GitHub tokens in a secrets system that can rotate them. Deny cloud language-model permissions to any identity whose job is something else. A key that can call a model and also create new credentials is two failures sharing a name.

Require phishing-resistant multi-factor authentication on the consoles that mint those keys. Turn on cloud audit logs and inference logs, and alert if they are switched off. Look for model endpoints and relays the company did not deploy. A host answering as a public proxy for several vendors, or a process talking to jet-night.com or newapi.pro, is an incident.

Block those relay domains on corporate networks. A coding assistant pointed at a third-party mixer spends someone else’s quota, and the prompt leaves the path in the contract. Patch CVE-2026-40217 wherever LiteLLM is installed. Keep model keys out of browsers and out of client-side bundles.

The $60 plan is the advertisement. The nearly $1 million line is the invoice. The control that matches this incident is a limit that trips before either number arrives as a surprise.

This briefing relies on public reporting by BleepingComputer and on the Google Threat Intelligence Group and Mandiant research that reporting describes. It does not include exploit procedures.